Karius Code of Ethics and Business Conduct

About the Code

The Karius, Inc. (“Karius”) Code of Ethics and Business Conduct (the “Code”) is intended to be an easily understandable summary of ethical challenges facing companies in our field. While the Code (and supporting Karius policies) won’t tell you exactly what to do in every situation, it can serve as a guide to help you make good decisions and navigate situations where the answer might not always be clear.

Our health care providers and patients are relying on us to deliver accurate and clinically useful information. In order to maintain our mission in a highly-regulated environment, all of us must exercise good judgment at all times. Failure to do so can be harmful to the company’s and your professional reputation. We must all hold ourselves to the highest standards of honesty, integrity, and fairness in our interactions with each other and our customers, health care providers, patients, payers, collaborators, vendors, suppliers, regulators, candidates, and all others outside the company. Karius expects you to operate with integrity and transparency in all of your dealings on behalf of the company, and to avoid even the appearance of impropriety.

Does the Code Apply to Me?

Karius expects all of its employees, directors, Board of Director members, advisors, contractors, and all parties acting on Karius’ behalf or who represent Karius to uphold the ethical standards set forth in this Code, to comply with the letter and spirit of all applicable laws, regulations, and accreditation standards, and to speak up if they have a question about how to proceed or a concern about conduct encountered at work.

What are my Obligations under the Code?

Follow the Code and Applicable Laws and Regulations and Ask Questions if You Are Not Sure About Something

Obeying the law is one of the foundations on which Karius’ compliance program is built. Each of us must respect and obey the applicable local, state, federal, and national laws, rules, regulations, and guidelines in the locations in which you operate. We understand the regulatory and legal framework under which we operate is quite complex and not always straightforward or clear so when in doubt, ask for guidance and help deciding the proper course of action.

Report Concerns

You are obligated to report a concern or a potential violation of the Code, law or regulation. If you receive a report of a violation or potential violation, you must escalate it to the appropriate party.

Participate in Investigations

If you are asked for information in a particular investigation, you must cooperate fully and to the best of your ability.

Anti-Retaliation Policy

Karius does not tolerate retaliation against anyone who raises concerns or questions regarding a potential violation of the Code that they reasonably believe to have occurred. Acts of retaliation should be reported immediately and will be promptly investigated and addressed.

Consequences for Failing to Comply

Please read the Code carefully and make sure you understand what it means to you. A violation of the Code could result in disciplinary action up to and including termination of your relationship with Karius.

How do I Ask for Help or Report a Concern?

If you feel any part of the Code has not been met, need access to more information, or have any questions or concerns, please ask for guidance or voice your concerns by contacting any of the following resources:

Legal department: General Counsel

legal@kariusdx.com / 650.409.5007, ext. 356

Privacy officer: General Counsel

privacy@kariusdx.com / 650.409.5007, ext. 356

Security officer:

security@kariusdx.com / 650.409.5007, ext. 149

Safety officer:

safety@kariusdx.com / 650.409.5007, ext. 117

Karius anonymous reporting hotline: 844.825.9914 (toll free)

Website: www.kariusdx.ethicspoint.com

You may also speak with a manager or any executive to discuss any concerns. If you feel uncomfortable reporting to a manager or a Karius employee, the anonymous reporting hotline is a toll-free phone number which you may use to ask questions or raise concerns and is available 24 hours a day, 7 days a week or you may submit your concerns through the website. This hotline is maintained by a third party on Karius’ behalf.

Your concerns will be taken seriously, and all information provided will be treated in a confidential manner, except to the extent necessary to conduct a thorough investigation of the complaint, or otherwise required by law.

In situations involving imminent harm or a criminal act (such as assault), contact appropriate law enforcement or emergency personnel first.

Karius’ Commitment to a Respectful and Safe Work Environment

Karius is committed to creating a safe work environment where everyone is treated with respect and dignity in the workplace to bring out the full potential in each of us, which, in turn, contributes directly to our business success.

Prohibition Against Harassment and Discrimination

Karius is committed to a workplace free of harassment, bullying, discrimination, and retaliation and supports its dedication to equal opportunity employment. This includes unacceptable behavior that is verbal, physical, or visual that creates an intimidating, offensive, or hostile working environment or that interferes with the performance of your work or duties with Karius. Examples include but are not limited to:

• Unwelcome or disrespectful comments, gestures, or physical contact;
• Disseminating or displaying offensive, derogatory, or explicit materials;
• Offensive or derogatory comments or jokes; or
• Verbal or physical abuse or threats.

This includes interactions with external parties such as customers and thought leaders. You should not discriminate on the basis of race, sex and gender, physical or mental disability, sexual orientation or any other characteristic protected by law for an opportunity with Karius. Karius employees are required to complete and certify anti-discrimination and anti-harassment training as required by California law.

Commitment to Diversity, Equity and Inclusion

Embracing diversity in every aspect of our business is key to our success. We firmly believe that workplace diversity, equity, and a culture of inclusion helps to spur innovation and create healthy and high-performing teams. We are committed to honor and invest in the full diversity of people in our hiring, recruiting, promotion, and development of employees across the Company.

We respect diversity in each other, our customers, suppliers, vendors, and all parties with which we interact. Karius is committed to creating an inclusive environment where diverse voices are active in all aspects of the organization. Every officer, manager, supervisor, and employee is expected to support and contribute to an environment that respects and values the diversity of our workforce.

We consider diversity comprehensively, including race, religious creed, color, national origin, ancestry, physical or mental disability, medical condition, genetic information, marital status (including registered domestic partnership status), sex and gender (including pregnancy, childbirth, lactation and related medical conditions), gender identity and gender expression (including transgender individuals who are transitioning, have transitioned, or are perceived to be transitioning to the gender with which they identify), age (40 and over), sexual orientation, Civil Air Patrol status, military and veteran status, and any other characteristic protected by federal, state, or local law (collectively referred to as “protected characteristics”) and other factors that shape the creative perspective and professional experience.

Commitment to the Environment, Health, & Safety

Working Safely

Karius strives to provide a safe and healthy work environment. We all have a responsibility for maintaining this safe and healthy workplace by:

• Following all environmental, health, and safety rules and practices;
• Reporting accidents, injuries, and unsafe equipment, practices, or conditions and developing corrective and preventative actions as appropriate; and
• Taking all reasonable precautions when handling hazardous or unsafe materials.

Only those trained in handling hazardous materials may assist in the transport or disposal of laboratory chemicals.

No Illegal Drugs and Substance Abuse

The use or possession of illegal drugs or controlled substances on Karius property or while you are engaged in any job-related activity, while on or outside of Karius property, is not allowed. In addition, you may not report to work while under the influence of or in an altered state due to the use of alcohol, drugs (legal or illegal), or controlled substances.

No Weapons

You may not possess any weapon while on Karius property.

Respect all Wage and Hour Rules

All applicable wage and hour laws and regulations must be followed by Karius and Karius partners, including the federal wage and hour laws under the Fair Labor Standards Act (“FLSA”) and applicable state wage and hour laws. Karius partners working on an hourly basis must report and record time accurately and contemporaneously in accordance with established local procedure. If you are paid on an hourly basis, you are entitled to overtime pay and working ‘off the clock’ is strictly prohibited.

Business Practices

Prohibition Against Corruption and Bribery

Karius complies with the U.S. Foreign Corrupt Practices Act (“FCPA”) and all other anti-corruption and anti-bribery laws. The FCPA prohibits the offer, payment, or promise to pay or give gifts, benefits, or anything of value, directly or indirectly to officials of foreign governments, foreign political candidates, and public international organizations in order to obtain an improper business advantage. Other countries have enacted similar restrictions with global reach, such as the United Kingdom’s Bribery Act, that covers both public and private sector employees. In many countries, health care providers and lab personnel are often employed by nationally-funded health institutions and universities, or serve as advisors to government health and reimbursement agencies, and thus may qualify as “government officials” under the FCPA. By doing business with Karius you understand and agree to cooperate with all reasonable inquiries into your organization to permit Karius to ensure it knows its business associates also hold themselves to the highest standards.

Karius’ policy strictly prohibits all forms of bribery, regardless of whether it involves government officials or private parties. You should not offer or accept bribes or kickbacks and must not participate in or facilitate corrupt activity of any kind. Karius (and by extension its agents, suppliers, contractors, and consultants working on Karius’ behalf) will not make facilitation payments, or payments to expedite routine matters, to any government or quasi-government official. Payments made by or on behalf of Karius to foreign officials should always be strictly for services rendered and reasonable given the nature of the services. A bribe can include all things of value including but not limited to money, discounts, gifts, or favors.

These types of laws can be complex. If you are not certain about anything concerning your interactions with officials or international companies, please contact the legal department for guidance.

Commitment to Following International Trade Laws

Karius is committed to following all applicable trade laws relating to the import, export, and re-export of goods and all laws regarding doing business in compliance with all economic and trade sanctions in the countries in which Karius does business. This includes compliance with the economic and trade sanctions administered by the Office of Foreign Assets Control (“OFAC”). Karius cannot accept blood materials from foreign sources without the proper permits from the Center for Disease Control (“CDC”) or the Food and Drug Administration (“FDA”), as applicable, as well as applicable shipping regulations, specifically including UN3373 and UN1845.

These laws can be complex, so contact the legal department whenever you are considering acquiring or transporting data or materials to or from another country (physically or electronically) or conducting business with a partner who is not a citizen or permanent resident of the United States.

Combatting Money Laundering & Terrorism Financing

Karius is committed to compliance with U.S. laws, orders, directives, and regulations to combat money laundering, terrorism financing, and related anti-money laundering (“AML”) obligations, to the extent applicable. Money laundering is the criminal practice of processing ill-gotten gains, or “dirty” money, through a series of transactions, often to conceal or disguise the origin, nature, source, or owner of the property. Money laundering laws extend liability to any person who knowingly undertakes activities or services involving illicit money or property, including where there is actual knowledge, reason to know, or conscious disregard of proceeds of crime.

When entering into business with third parties, Karius will conduct, on a risk basis, appropriate screening of sanctioned/restricted party lists published by applicable U.S. government authorities (such as the U.S. Office of Foreign Assets Control Specially Designated Nationals and Blocked Persons List or Financial Crimes Enforcement Network’s Section 311 list of institutions of money laundering concern) for concerns or red flags, including but not limited to relevant sanctions or money laundering lists, review for persons subject to asset freezing orders and other restrictive measures, and evaluation of politically exposed person or senior foreign political official concerns.

If a transaction, investment, financing, contract, or agreement is subject to restrictions, is suspicious, presents a cause for concern, or may present an inordinately high legal or reputational risk to the business, you must escalate to Karius’ legal department.

Keeping and Managing Accurate Books and Records

All Karius business records must be as complete, accurate, and honest as possible in order to make responsible business decisions. All transactions are to be recorded contemporaneously and reported in accordance with generally accepted accounting principles and in compliance with our accounting policies and procedures including established systems of internal controls.

All of Karius’ books, records, accounts, and financial statements must be maintained in reasonable detail, must appropriately reflect company transactions, and must conform both to legal requirements and to Karius’ system of internal controls. All payments and expenses must be supported by appropriate documentation, like an active agreement for payment of third parties or payment receipts for meals, including business objectives and attendees, and must include appropriate approvals when required.

Karius has the responsibility to maintain, retain, and destroy company records, whether paper or electronic, in accordance with all legal and regulatory recordkeeping requirements. If you have access to confidential information you have an additional level of responsibility to protect it. You must not knowingly destroy or discard information that is subject to a legal hold.

Avoiding Conflicts of Interest

Everyone must avoid situations that might involve a conflict of interest or even the appearance of a conflict. A conflict of interest occurs when a person’s private interest actually or potentially makes it difficult for that person to act objectively and in the best interest of Karius.

It is not feasible to describe all possible conflicts that could arise, but some examples of conflicts are:

• Gifts, gratuities, special allowances, discounts, or other advantages not generally available to others;
• Familial or romantic relationships between a manager and a direct report or Karius employees and vendors; and
• Misuse of Karius proprietary or confidential information.

Conflicts of interest may not always be obvious. When in doubt, discuss a potential conflict with a manager or the legal department. Please consult Karius’ Conflicts of Interest Policy for additional information.

Regulatory Compliance

Contracting with government entities, including research grants or funding, involves special concerns around conflicts of interest and rules and regulations to prevent fraud, waste, and abuse. Karius takes this responsibility seriously as well as the duty to detect and prevent infractions and adherence with the laws that govern Karius as a healthcare provider. The consequences for failing to comply with these laws can be severe and violations would prevent you from having a relationship with Karius.

In particular, Karius must abide by the following rules of law, although there may be similar state and other federal laws that apply as well:

False Claims Act (“FCA”): The FCA is a federal statute that establishes liability for knowingly presenting a false or fraudulent claim for payment to the United States government or to a government contractor. This includes claims submitted to Medicare or Medicaid. For example, this includes such things as billing Medicare for services not rendered or medically unnecessary services, participating in kickbacks, and retaining overpayment for services or items. Violations of the FCA could result in civil, criminal, and administrative penalties including monetary penalties, imprisonment, exclusion from participation in federal healthcare programs and loss of licensure. Accurate books and records are key in ensuring compliance with the FCA.

Anti-Kickback Statute (“AKS”): AKS is a criminal law that makes it a crime to willfully offer, pay, solicit, or receive anything of value, to induce or reward patient referrals or the generation of business involving any item or services paid under federal healthcare programs. To ensure compliance all payment arrangements or offers of anything of value should be vetted by the legal department. Moreover, even offering well-intentioned perks to health care providers or their staff puts them in an awkward position as most professional and health care organizations have internal rules strictly prohibiting such practices.

Physician Self-Referral Law (“Stark Law”): The Stark Law is a federal law that prohibits physicians from making referrals to a provider for designated health services when the physician or an immediate family member of the physician has a financial relationship with the provider. In addition, many states have versions of the Stark Law such as Physician Ownership and Referral Act of 1993, (“PORA”) for California. Financial relationship can mean ownership, investment, or compensation even if you did not enter into the financial relationship with the intent to pay for the referral. When working with physicians who provide services to Karius, you must work with the designated team to put a contract in place for the physician so that any fees paid are tracked and reported properly.

Karius complies with all applicable clinical laboratory and human subject research regulations, including the rules of the Clinical Laboratory Improvement Act (“CLIA”), College of American Pathology (“CAP”) accreditation requirements, Federal Policy for the Protection of Human Subjects, and other state requirements for clinical laboratory testing. In order to ensure that all results provided to Karius’ customers are accurate and reproducible, all company employees, contractors, and partners are responsible for adhering to all applicable internal quality and regulatory policies and procedures.

Business Courtesies and Gifts

Promoting Karius and building business relationships may appropriately involve giving to and receiving from third parties certain gifts, meals, and entertainment (collectively “Gifts”). However, this practice can create a conflict of interest or bias that could be viewed as a bribe. In all cases, Gifts should be made openly and transparently, be reasonable and appropriate to the relationship and local customs, not be intended to place the recipient under any obligation or persuasion, and accurately and contemporaneously reflected in Karius’ books and records where required. Gifts of cash or cash equivalents are prohibited.

You may give or receive Gifts under the circumstances provided for above. Some examples of acceptable Gifts are:

• Meals, cocktail hours, or parties;
• Tickets to events (but not transportation to or from the event);
• Token holiday gifts and or branded merchandise; and
• Gift cards (but in no circumstances to exceed $100US in cash value).

Gift giving must also comply with anti-corruption and anti-kickback laws and all other rules regarding gifts specific to our industry and these guidelines are not meant to override any of those laws. Please contact the legal department if you have any questions or concerns about giving or receiving Gifts.

Communicating with Government Representatives, Regulators, and Auditors

Karuis is part of a highly regulated industry, and employees and representatives may be contacted by government or agency representatives about Karius or those representatives may come on site. Karius wants to ensure that these entities obtain accurate information to which they are legally entitled to receive. If you come into contact with such a representative, or you meet or come across a representative in the office, please notify your supervisor or the legal department immediately. You should not accept service of process (legal process for notifying a business that legal action has been taken against it) on behalf of Karius unless you are authorized to do so.

Protecting Company Assets and Patient Privacy

Protecting Confidential Information

Everyone is responsible for maintaining the confidentiality of information entrusted to them by Karius and its customers and business associates. You should use company confidential information, property, and resources only for their authorized, proper, and intended use. If you have access to confidential information of Karius or a third party with whom Karius has an obligation to protect such information, you must limit the disclosure of the information only to other employees, contractors, and third parties who have a need to know and understand the nature of the information.

You have a duty to protect confidential and sensitive information, including but not limited to trade secrets, proprietary study data, and financial, employee, and customer information. Keep all information marked, or known to be “confidential,” secured from access by unauthorized parties. Karius employees who handle confidential data or sensitive information are required to know the applicable procedures and strictly adhere to them at all times.

Protecting Intellectual Property

Do not disseminate clinical study results, process improvements, innovations, technical improvements, or data unless you have first obtained approval from a manager and the legal department. In particular, all research papers, abstracts, or any other materials that will be presented publicly should be routed through marketing and legal prior to any such public dissemination in order to have it reviewed for potential intellectual property issues.

Our Commitment to Protecting Personal Health Information

Protecting the privacy and security of personal health information is very important to Karius’ mission. Failure to do so may result in not only monetary penalties, but also the loss of trust of customers, patients, research participants, and collaborators. Karius is committed to patient privacy and requires that all members of its workforce and all vendors handle identifiable patient health information with the highest level of confidentiality in accordance to all applicable laws, contractual commitments, and ethical standards, including the Health Insurance Portability Act of 1996 (and its implementing regulations) and California’s Confidentiality of Medical Information Act.

Only those employees or contractors with specific authorization may access personal health information, and such access may only be for authorized purposes and only the minimum necessary to accomplish such authorized purposes may be accessed, used, and disclosed.

Communicating with the Press and Social Media

Only those Karius employees who have specifically been appointed to speak to the press or post to the internet or any social networking service may do so on Karius’ behalf. Executives, officers, directors, and managers have a special duty of care when posting communications since their opinions may be deemed to express those of Karius in any context, even in their personal social media accounts.

If you receive any inquiry from the press, please refer them to the Karius marketing department at media@kariusdx.com.